So, immediately I see that you have two pattern type filters, trying to match prefix logs- and prefix kubernetes-. This is your problem. In the official documentation it explains that all filters are connected by logical a AND. It does provide an example of using kind: regex to do a logical OR for pattern matching. This would allow you to catch both logs- and kubernetes- prefix types.